MCP Server Monetization: Production Models

┌───────────────────────┐         ┌─────────────────────────┐         ┌───────────────────────┐
│ Client Agent Runtime  │         │   Enterprise Gateway    │         │  Private VPC / Store  │
│ (Claude / Cursor CLI) │ ──────> │  (mTLS / Bearer Token)  │ ──────> │ (ERP, Postgres, CRM)  │
└───────────────────────┘         └─────────────────────────┘         └───────────────────────┘
                                               │
                                               ▼
                                  Stripe Invoicing / Retainer

// server-stripe-billing.ts
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
import Stripe from 'stripe';
import { z } from 'zod';

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!, {
  apiVersion: '2025-02-24.acacia',
});

// In-memory customer cache (backed by Redis or PostgreSQL in production)
interface CustomerAccount {
  customerId: string;
  subscriptionStatus: 'active' | 'past_due' | 'canceled';
  planTier: 'free' | 'pro' | 'enterprise';
  dailyCallCount: number;
}

const customerDb = new Map<string, CustomerAccount>();

async function authenticateRequest(req: Request): Promise<CustomerAccount> {
  const authHeader = req.headers.get('Authorization');
  if (!authHeader?.startsWith('Bearer ')) {
    throw new Error('Missing or invalid Authorization header. Provide: Bearer <API_KEY>');
  }

  const apiKey = authHeader.replace('Bearer ', '').trim();
  const account = customerDb.get(apiKey);

  if (!account) {
    throw new Error('Unauthorized: Invalid API key.');
  }

  if (account.planTier === 'free' && account.dailyCallCount >= 100) {
    throw new Error('Rate limit exceeded: 100 calls/day on free tier. Upgrade at https://example.com/pricing');
  }

  if (account.subscriptionStatus !== 'active' && account.planTier !== 'free') {
    throw new Error('Payment required: Subscription is past due.');
  }

  return account;
}

export function createBillingMcpServer(account: CustomerAccount): McpServer {
  const server = new McpServer({
    name: 'enterprise-compliance-scanner',
    version: '1.0.0',
  });

  server.registerTool(
    'audit_iac_template',
    {
      description: 'Scans Terraform or CloudFormation templates for CIS compliance violations. Billed at $0.02 per evaluation for Pro tiers.',
      inputSchema: {
        templateContent: z.string().describe('Raw infrastructure-as-code content'),
        framework: z.enum(['CIS', 'SOC2', 'HIPAA']).default('CIS'),
      },
    },
    async ({ templateContent, framework }) => {
      // 1. Report metered event to Stripe for usage-based billing
      if (account.planTier === 'pro') {
        await stripe.billing.meterEvents.create({
          event_name: 'iac_compliance_scans',
          payload: {
            value: '1',
            stripe_customer_id: account.customerId,
          },
        });
      }

      account.dailyCallCount += 1;

      // 2. Execute proprietary compliance scan logic
      const violations = runComplianceScan(templateContent, framework);

      return {
        content: [
          {
            type: 'text',
            text: JSON.stringify({ framework, violationsCount: violations.length, violations }, null, 2),
          },
        ],
      };
    }
  );

  return server;
}

function runComplianceScan(content: string, framework: string) {
  // Production scanning engine
  return [{ ruleId: 'CIS-1.2', status: 'PASS', description: 'Root accounts MFA enforced' }];
}

{
  "mcpServers": {
    "compliance-scanner": {
      "endpoint": "https://api.example.com/sse",
      "headers": {
        "Authorization": "Bearer mcp_live_sec_9942a1"
      }
    }
  }
}

[mcp_servers.compliance_scanner]
url = "https://api.example.com/sse"
headers = { Authorization = "Bearer mcp_live_sec_9942a1" }

Agent Runtime                   MCP Server                 Payment Endpoint (MPP)
     │                              │                               │
     ├─ 1. call_tool(create_job) ──>│                               │
     │<─ 2. returns paymentLink ────┤                               │
     │                                                              │
     ├─ 3. POST /api/settle (no credential) ───────────────────────>│
     │<─ 4. HTTP 402 Challenge (WWW-Authenticate: Payment) ────────┤
     │                                                              │
     ├─ 5. Sign challenge with Stripe SPT ─────────────────────────>│
     │<─ 6. HTTP 200 + Verified Result + MPP Receipt ───────────────┤

npm install @modelcontextprotocol/sdk @hono/node-server hono mppx stripe zod

// mpp-server.ts
import crypto from 'node:crypto';
import StripeClient from 'stripe';
import { serve } from '@hono/node-server';
import { Hono } from 'hono';
import { Mppx, stripe } from 'mppx/server';
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { z } from 'zod';

const stripeClient = new StripeClient(process.env.STRIPE_SECRET_KEY!);

// Derive deterministic HMAC key for challenge signing
const mppSecretKey = crypto
  .createHmac('sha256', process.env.STRIPE_SECRET_KEY!)
  .update('mpp-challenge-signing')
  .digest('base64');

const stripeMachinePayments = stripe.create({
  client: stripeClient,
  networkId: process.env.STRIPE_PROFILE_ID!,
  livemode: !process.env.STRIPE_SECRET_KEY!.includes('_test_'),
});

const mppx = Mppx.create({
  methods: [stripeMachinePayments.spt.charge()],
  secretKey: mppSecretKey,
});

const app = new Hono();

// 1. Paid settlement endpoint answering with HTTP 402 challenges
app.post('/api/compute-settlement', async (c) => {
  const result = await mppx.compose([
    'stripe/charge',
    {
      amount: '0.05',
      currency: 'usd',
      decimals: 2,
      description: 'Dedicated Sandbox Execution (500ms compute)',
    },
  ])(c.req.raw);

  if (result.status === 402) {
    return result.challenge;
  }

  // Payment verified by Stripe SPT — execute privileged compute
  const body = await c.req.json();
  const output = executeSandboxedJob(body.script);

  return c.json({
    status: 'success',
    output,
    receipt: result.receipt,
  });
});

// 2. Expose MCP tool informing agent of settlement URL
const mcp = new McpServer({ name: 'sandboxed-executor', version: '1.0.0' });

mcp.registerTool(
  'request_isolated_execution',
  {
    description: 'Executes untrusted Python code in a secure firewalled microVM. Costs $0.05 per execution. Returns an MPP paymentLink.',
    inputSchema: { script: z.string() },
  },
  async ({ script }) => {
    return {
      content: [
        {
          type: 'text',
          text: JSON.stringify({
            paymentLink: `${process.env.BASE_URL}/api/compute-settlement`,
            instructions: 'POST to paymentLink with Stripe Shared Payment Token (SPT) on HTTP 402 challenge.',
            cost: '$0.05 USD',
          }),
        },
      ],
    };
  }
);

function executeSandboxedJob(code: string) {
  return { stdout: 'Execution completed safely.', exitCode: 0 };
}

serve({ fetch: app.fetch, port: 3000 });

// RECOMMENDED: Transparent price and prerequisites in tool description
server.registerTool(
  'resolve_corporate_beneficial_owners',
  {
    description: 'Look up ultimate beneficial owners (UBO) from verified corporate state registries. ' +
                 'Cost: $0.15 USD per query billed to your API key. ' +
                 'Only invoke this tool when the user explicitly requests verified ownership audits.',
    inputSchema: {
      jurisdiction: z.string().describe('Two-letter ISO country code'),
      companyRegistrationNumber: z.string(),
    },
  },
  async (args) => { /* ... */ }
);